]> git.koha-community.org Git - koha.git/commit
Bug 27715: Sanitize order by DT params
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Thu, 18 Feb 2021 14:49:40 +0000 (15:49 +0100)
committerJonathan Druart <jonathan.druart@bugs.koha-community.org>
Tue, 23 Feb 2021 23:12:59 +0000 (00:12 +0100)
commit893e60acbc1f0acb22a9bfe85219fcf76af41092
tree2bcaf56ea02105c372bece8cf725d3f347ba67b4
parent88dce684cfdab8db96589d005ffb6119ecc58b79
Bug 27715: Sanitize order by DT params

We are not on the safe side when we build the ORDER BY clause from the
DataTables parameters.

I've started to limit the columns by using Koha::Objects->columns, but
for instance for the patron search we need (at least) the columns from
the branches, categories and members tables.
It seems easier, and still safe, to use a regex.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
C4/Utils/DataTables.pm